ldnbuirfdfd[.]speciale14[.]workers[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Google. Analysis indicates the infrastructure is designed to deceive users into believing they are interacting with legitimate Google services, likely for credential theft or account compromise. The page title explicitly mimics Google’s branding, reinforcing the deception. Infrastructure analysis reveals the domain resolves to 142.251.151.119, hosted on Cloudflare’s network (AS13335) in the United States. The domain is registered through Cloudflare, Inc., and currently remains active. Despite its malicious intent, the domain has not been flagged by VirusTotal (0/95 detections). However, it appears on three security blocklists and is blocked by multiple threat intelligence feeds. The SSL certificate is issued by Google Trust Services (WE1), further blending into legitimate traffic patterns. Mitigation requires immediate blocking of the domain and associated IP at the network perimeter. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems and monitor for connections to 142.251.151.119. User awareness training should emphasize verifying domain authenticity before entering credentials, particularly for services mimicking Google. Security teams are advised to inspect logs for prior interactions with this domain and assess potential account exposure. Given the active status and lack of detections on major scanning platforms, manual verification of related subdomains or similar Cloudflare Workers-hosted infrastructure is recommended.